CVE-2026-0303
Awaiting Analysis Awaiting Analysis - Queue

Arbitrary Code Execution in Checkov by Prisma Cloud

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: Palo Alto Networks, Inc.

Description
A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can allow arbitrary code execution when Checkov scans a directory that contains an attacker-controlled configuration file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-30
AI Q&A
2026-09-10
EPSS Evaluated
2026-09-29
NVD
CVE-2026-0303
EUVD
EUVD-2026-75269

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
palo_alto_networks checkov From 3.2.0 (inc) to 3.2.531 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-829 The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a code execution vulnerability in Palo Alto Networks Checkov by Prisma Cloud. It allows arbitrary code execution when Checkov scans a directory containing an attacker-controlled configuration file. The issue affects versions 3.2.0 through 3.2.531 and is classified under CWE-829 and CAPEC-248.

Detection Guidance

To detect this vulnerability, check the installed version of Checkov using the command: checkov --version. If the version is between 3.2.0 and 3.2.531, the system is vulnerable. Additionally, monitor for unexpected code execution during scans of untrusted directories.

Impact Analysis

Exploitation can lead to arbitrary code execution on systems running vulnerable Checkov versions. Attackers could run malicious code if Checkov scans untrusted directories. No special configuration is needed for exploitation, and it can occur during scans of infrastructure as code files from untrusted sources.

Compliance Impact

This vulnerability may impact compliance with standards like GDPR and HIPAA by potentially allowing unauthorized code execution during security scans of infrastructure as code files. If exploited, it could lead to data breaches or unauthorized access, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Immediately upgrade Checkov to version 3.2.532 or later. As a temporary measure, avoid running Checkov on untrusted content and explicitly pass trusted configuration files instead of auto-loading from scanned directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-0303. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart